topic Re: Are logs in encrypted form while sending to management server? in Firewall and Security Management

Are logs in encrypted form while sending to management server?

usmanshah526 — Sun, 27 Nov 2022 18:35:58 GMT

Hello All,

I have one query about logs if any one know the answer please reply the same.

query is between management servers and gateways logs sending in which format like plain text and encrypted form?

and if it’s sending logs in plain format is it possible to man in the middle attacker to read the logs while sending to management server?

Re: Are logs in encrypted form while sending to management server?

_Val_ — Mon, 28 Nov 2022 11:51:53 GMT

Logs are sent through a protected channel with certificate-based authentication. I would be very surprised if you manage to do MitM attach on that.

Re: Are logs in encrypted form while sending to management server?

usmanshah526 — Fri, 02 Dec 2022 09:23:15 GMT

Thanks for your reply is there any way we can show that logs was encrypted during forwarding logs management server, because auditor ask they same questions to us and if is it mentioned in any document please share if you have any docs or articles related to this topic.

Re: Are logs in encrypted form while sending to management server?

Blason_R — Fri, 02 Dec 2022 09:38:18 GMT

Its pretty simple - Capture the packet in your switch for port TCP/257 or even on mgmt server for port TCP/257. Try to read the logs. Since mgmt server is CA and then distributes certificates to difference component like firewalls and event viewer if deployed separately. The entire communication is encrypted using certificates

Re: Are logs in encrypted form while sending to management server?

the_rock — Fri, 02 Dec 2022 11:12:24 GMT

I dont believe there is specific document saying so, but its been that way with CP since the beginning. @Blason_R and @_Val_ are 100% correct!

Re: Are logs in encrypted form while sending to management server?

the_rock — Fri, 02 Dec 2022 11:44:52 GMT

Also, to add to this, any communication between mgmt and gateway would be encrypted. Think of basic scenario...lets say SIC breaks on the firewall and you have to reset it. Key you put on for sic reset, does not matter, can be 12345678, its a one time password thats encrypted and its gone, thats it.

But, if you really need document stating than, I will let someone else provide it, as I had never seen one stating so.

Re: Are logs in encrypted form while sending to management server?

Chris_Atkinson — Fri, 02 Dec 2022 11:58:38 GMT

Please refer to the section on SIC in the Security Management Admin Guide for your version, aswell as describing the encryption used by SIC it states this "trust" is required to send logs from Gateway to Management etc.

Re: Are logs in encrypted form while sending to management server?

Wolfgang — Fri, 02 Dec 2022 12:06:08 GMT

@usmanshah526 you can find these information in the documentation Secure Internal Communication (SIC)

encryption type, which communication is encrypted etc.